What is the CVSS score of CVE-2026-23878?

CVE-2026-23878 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Hotcrp are affected by CVE-2026-23878?

Organizations using commit aa20ef288828b04550950cf67c831af8a525f508 and should be aware of notable risk from CVE-2026-23878 rated CVSS 6.5.. A patch is available.

How to fix or mitigate CVE-2026-23878?

Within 30 days: Identify affected systems running commit aa20ef288828b04550950cf67c831af8a525f508 and and apply vendor patches as part of regular patch cycle. Vendor patch is available.

Hotcrp CVE-2026-23878

MEDIUM

Insertion of Sensitive Information Into Sent Data (CWE-201)

2026-01-19 security-advisories@github.com

Information Disclosure Hotcrp

6.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

Patch released

Feb 05, 2026 - 18:39 nvd

Patch available

CVE Published

Jan 19, 2026 - 19:16 nvd

MEDIUM 6.5

DescriptionGitHub Advisory

HotCRP is conference review software. Starting in commit aa20ef288828b04550950cf67c831af8a525f508 and prior to commit ceacd5f1476458792c44c6a993670f02c984b4a0, authors with at least one submission on a HotCRP site could use the document API to download any documents (PDFs, attachments) associated with any submission. The problem was patched in commit ceacd5f1476458792c44c6a993670f02c984b4a0.

AnalysisAI

HotCRP is conference review software. [CVSS 6.5 MEDIUM]

Technical ContextAI

Affects Hotcrp. HotCRP is conference review software. Starting in commit aa20ef288828b04550950cf67c831af8a525f508 and prior to commit ceacd5f1476458792c44c6a993670f02c984b4a0, authors with at least one submission on a HotCRP site could use the document API to download any documents (PDFs, attachments) associated with any submission. The problem was patched in commit ceacd5f1476458792c44c6a993670f02c984b4a0.